How to solve the unauthorized access vulnerability of Spring Boot Actuator

The role of Spring Boot Actuator is to provide a set of management and monitoring endpoints, allowing you to view the runtime information of the application, such as health status, application information, performance indicators, etc. These endpoints are useful for development, testing , and operations teams to help quickly diagnose issues, monitor application performance, and take necessary actions to maintain and manage the application.

Spring Boot Actuator unauthorized access configuration

Spring Boot Actuator provides many useful endpoints for application runtime information, such as /health, /info, /metrics, etc. These endpoints can help developers and operations personnel monitor and manage Spring Boot applications. By default, these endpoints require authorization to access to ensure security.

If you encounter the problem of unauthorized access to Spring Boot Actuator, you can take the following steps to solve it:

1. Add Spring Security dependency

To enable authorization, you can add Spring Security dependency to your project. In a Maven project, you can add the following dependencies:

<dependency> <groupId>org.springframework.boot</groupId> <artifactId>spring-boot-starter-security</artifactId> </dependency>

In your Gradle project, you can add the following dependencies:

implementation 'org.springframework.boot:spring-boot-starter-security'

2. Configure Spring Security permissions

Create a configuration class to configure Spring Security to control access to the Actuator endpoint. The following is an example configuration class:

import org.springframework.context.annotation.Bean; import org.springframework.context.annotation.Configuration; import org.springframework.security.config.annotation.web.builders.HttpSecurity; import org.springframework.security.config.annotation.web.configuration.EnableWebSecurity; import org.springframework.security.config.annotation.web.configuration.WebSecurityConfigurerAdapter; @Configuration @EnableWebSecurity public class SecurityConfig extends WebSecurityConfigurerAdapter { @Override protected void configure(HttpSecurity http) throws Exception { http .authorizeRequests() .antMatchers("/actuator/**").hasRole("ACTUATOR") .anyRequest().authenticated() .and() .httpBasic(); } }

This example configuration allows authorized users to access all URLs starting with "/actuator/" and requires the user to have the "ACTUATOR" role. You can customize the configuration according to your needs.

3. Configure the role of the Actuator endpoint

In Spring Boot's application properties file (such as application.properties or application.yml), you can configure the role requirements for the Actuator endpoint. For example, in application.properties:

management.endpoint.health.roles=ACTUATOR management.endpoint.metrics.roles=ACTUATOR

This specifies that only users with the "ACTUATOR" role can access the /actuator/health and /actuator/metrics endpoints.

4. Assign roles to users

Make sure authorized users are assigned the correct roles. You can configure roles in your user authentication and authorization services.

5. Test access

Test using credentials (username and password) with the correct role to ensure that unauthorized access no longer occurs when accessing restricted Actuator endpoints. With these steps, you can configure the Spring Boot Actuator to require authorized access and restrict access to these endpoints to only users in specific roles. This helps protect your application's sensitive information.

Precautions

When using Spring Boot Actuator, you need to pay attention to the following:

Role Assignment: Ensure that authorized users are assigned the correct roles to access Actuator endpoints. Assignment of roles can be performed in the user authentication and authorization service.
Version compatibility: Different versions of Spring Boot Actuator may have some configuration differences, so be careful to check the documentation and configuration when upgrading or downgrading.
Security: Spring Boot Actuator endpoints contain sensitive information, so make sure you secure them appropriately to prevent unauthorized access.

Use Apifox testing and management interface

Apifox is a more powerful interface testing tool than Postman. Apifox = Postman + Swagger + Mock + JMeter. It supports debugging interfaces of http (s), WebSocket, Socket, gRPC , Dubbo and other protocols, and integrates the IDEA plug-in . After developing the interface, you can automatically generate the interface document with one click through Apifox's IDEA plug-in, and synchronize multiple terminals, which is very convenient for testing and maintenance.

Knowledge expansion:

Reference links:

Spring Boot Actuator official documentation